zalando / skipper / 41504669947

81%

Build Type

push

github

Committed by web-flow

Commit Message

fix: apply allowed external names to skipper-routes annotation backends (#4361)

`-kubernetes-only-allowed-external-names` is not enforced for routes
from the Ingress `zalando.org/skipper-routes` annotation:
- Repro: allow list `^external1[.]example[.]org$`, Ingress annotation
`network: Header("X-Route", "network") -> "http://169.254.169.254";`
plus an LB route with endpoint `http://10.0.0.1:8080`
- Expected: both routes rejected, the same as a RouteGroup network
backend or explicit LB endpoint
- Actual: `addExtraRoutes` emits both routes unchanged, so anyone who
can create an Ingress can proxy to any address and bypass the allow list
(SSRF)
- Fix: drop annotation routes whose network backend or LB endpoints fail
`isExternalAddressAllowed`, and log an error. Nothing changes unless the
toggle is set, since the allow list is `.*` by default

The new `external-name/routes-annotation-not-allowed` fixture gives 5
routes before the fix and 3 after.

---------

Signed-off-by: Ramya Eliger <ramya@digiscrypt.com>

Coverage Stats

10 of 10 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

27942 of 34409 relevant lines covered (81.21%)

72668.67 hits per line